APPARATUS AND METHODS FOR CONTENT DELIVERY AND MESSAGE EXCHANGE ACROSS MULTIPLE CONTENT DELIVERY NETWORKS

• US 20120011567A1
• Filed: 07/12/2010
• Published: 01/12/2012
• Est. Priority Date: 11/24/2008
• Status: Active Grant

• Current Assignee: Gary Cronk, James Boutilier, Jonathan Putsch, Michael Dillon, Paul L. Miller
• Original Assignee: Time Warner Cable Enterprises LLC (Charter Communications Incorporated)
• Inventors: Putsch, Jonathan, Boutilier, James, Miller, Paul L., Dillon, Michael, Cronk, Gary
• Granted Patent: US 9,357,247 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04N 21/2541 Rights Management protecting software against unauthorised usage in a vending or licensing environment G06F21/10; security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/25816 involving client authentication restricting access to computer systems by authenticating users using a predetermined code G06F21/33; cryptographic authentication protocols H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/25875 involving end-user authentication restricting access to computer systems by authenticating users using a predetermined code G06F21/33; arrangements for secret or secure communication including means for verifying the identity or authority of a user of the system H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/47202 for requesting content on demand, e.g. video on demand
• CPC Class Codes: H04N 21/4753 for user identification, e.g. by entering a PIN or password cryptographic authentication protocols H04L9/32; networks authentication protocols H04L63/08
• CPC Class Codes: H04N 21/6125 involving transmission via Internet transmission by internet of broadcast information H04H60/82
• CPC Class Codes: H04N 21/6581 Reference data, e.g. a movie identifier for ordering a movie or a product identifier in a home shopping application

Abstract

Methods and apparatus for providing protected content to subscribers of a managed (e.g., MSO) network via a content source accessible via an internetwork such as the Internet. In one embodiment, a user accesses a programmer website, and requests content. The programmer determines whether the requesting user is permitted to access the content, and what rights or restrictions are associated with the user. This includes authenticating the user as a subscriber of the MSO, and determining the subscriber'"'"'s subscription level. In another embodiment, a user'"'"'s account with the MSO and programmer may be federated, thus a given user will have MSO-specific information regarding its identity (such as login information, GUID, etc.) and/or information regarding subscription level and service details, stored at the programmer. Messages received from the MSO representing permission for the user to access content may also be stored at the programmer site for later reference.

Claims

1. A method for determining at a content distribution network entity permission of a subscriber of said network to access protected content from a remote source via the Internet, said method comprising:

receiving at said network entity a communication relating to a request for said protected content from a user device, said communication being sent to said content distribution network entity from an entity associated with said remote source;

determining whether said user device is associated to said subscriber of said content distribution network;

if said user device is associated to said subscriber, determining whether said protected content is within an approved level of service of said subscriber; and

if said protected content is within said approved level of service of said subscriber, transmitting a message to said entity associated with said remote source, said message causing said remote source to deliver said protected content to said user device.

2. The method of claim 1, wherein said content distribution network comprises a hybrid fiber/non-fiber network having at least one interface to communicate with said remote source via the Internet, and said remote source comprises at least one Internet-based programmer.

3. The method of claim 1, wherein said act of determining whether said user device is associated to said subscriber of said network comprises requiring a user of said device to provide information identifying said user as a subscriber, said information comprising login information.

4. The method of claim 1, wherein if said user device is not associated to said subscriber, said method further comprises transmitting a message to said entity associated with said remote source denying service to said user device.

5. The method of claim 1, wherein if said protected content is not within said approved level of service of said subscriber, said method further comprises transmitting a message to said entity associated with said remote source denying service to said user device.

6. The method of claim 1, wherein said communication relating to a request for said protected content from a user device comprises an obfuscated communication selected from the group consisting of (i) an encrypted communication;

and (ii) a cryptographically hashed communication.

7. The method of claim 1, wherein said communication comprises a globally unique identifier (GUID) that identifies the remote source.

8. The method of claim 7, wherein said communication comprises a globally unique identifier (GUID) that identifies the user device or subscriber.

9. The method of claim 8, wherein said causing said delivery of said protected content to said user device comprises delivery of said protected content with a less than complete set of use rights.

10. The method of claim 9, wherein said less than complete set of use rights is determined at least in part based on said determining whether said protected content is within a level of service of said subscriber.

11. The method of claim 1, wherein said protected content comprises first-run content not generally available on said Internet.

12. An apparatus for managing delivery of a plurality of protected content from a remote content server to a plurality of entitled users, said apparatus comprising:

at least one first interface for receiving a plurality of information from a user device, said information comprising;

information identifying a user of said user device; and

information identifying a particular one of said plurality of protected content requested by said user;

a first computer program configured to utilize said information identifying said user to determine whether said user is among said plurality of entitled users;

a second computer program configured to utilize said information identifying said user and said information identifying said particular one of said plurality of protected content to determine whether said particular one of said plurality of protected content is within an authorized service class for said user; and

at least one second interface for transmitting at least one message to a remote content server, said at least one message causing said remote content sever to;

(i) provide said protected content to said user device, or (ii) to deny said user device said protected content;

wherein said message is based at least in part on said determination of whether said user is among said plurality of entitled users, and said determination of whether said particular one of said plurality of protected content is within said authorized service class for said user.

13. The apparatus of claim 12, wherein said at least one first interface comprises a website, and said information identifying said user of said user device comprises login information and a password established by said user.

14. The apparatus of claim 13, wherein said apparatus is associated with a managed content distribution network having an operator, and said website comprises a third party website not operated by said managed network operator.

15. The apparatus of claim 12, wherein said at least one first interface receives said plurality of information from said remote content server.

16. The apparatus of claim 12, wherein said determination of whether said user is among said plurality of entitled users comprises querying at least one database comprising a plurality of records, said plurality of records correlating a plurality of identifying information to respective ones of said plurality of entitled users.

17. The apparatus of claim 12, wherein said determination of whether said particular one of said plurality of protected content is within said authorized service class for said user comprises using said information identifying said user to query at least one database comprising a plurality of service detail records for each of said plurality of entitled users.

18. A method for determining whether a user is permitted in a first network to access protected content associated with a second network, said method comprising:

receiving a request for said protected content from said user in said first network;

determining said second network to which said user is associated;

sending a message to said second network, said message comprising;

login and password information entered by said user; and

said request for said protected content; and

receiving, in response to said message, a message indicating whether said user is permitted in said first network to access said protected content associated with said second network.

19. The method of claim 18, wherein said login and password information comprise information pre-established at said second network to correspond to said user.

20. The method of claim 18, wherein said message indicating whether said user is permitted in said second network to access said protected content is stored at an entity of said second network.

21. The method of claim 18, further comprising receiving second login and password information entered by said user and specific to said second network.

22. A method of determining whether a particular one of a plurality of protected content may be provided to a user via a first network based at least in part on service details of said user in a second network, said method comprising:

receiving a request for authorization of said user'"'"'s access to said particular one of said plurality of protected content from an entity of said first network, said request for authorization comprising at least a globally unique identifier (GUID) associated with said user and information identifying said particular one of said plurality of protected content;

determining in response to said request, whether a session has been established by said user and said second network;

determining a subscriber identity within said second network based at least in part on said GUID;

retrieving said service details associated with said user;

comparing said service details to said information identifying said particular one of said plurality of protected content; and

if said service details match said information identifying said particular one of said plurality of protected content, providing a message enabling said particular one of said plurality of protected content to be delivered to said user via said first network.

23. The method of claim 22, wherein said method further comprises, if said service details do not match said information identifying said particular one of said plurality of protected content, providing a message denying said user request for delivery of said particular one of said plurality of protected content.

24. The method of claim 22, wherein said method further comprises, if a session has not been established, establishing a session by requesting login information from said user.

25. The method of claim 22, wherein if the comparison yields indeterminate results, enabling said entity of said first network to resend said request for authorization.

26. A method for enabling the distribution of protected content associated with a managed content distribution network to subscribers of the network via the Internet, said method comprising:

receiving a communication relating to a request for said protected content from a subscriber, said communication being sent from an entity associated with a third party content source that has access to said protected content;

determining whether said protected content is authorized for delivery to said subscriber; and

if said protected content is authorized, causing said third party content source to deliver said protected content to said subscriber.

27. The method of claim 26, wherein said third party content source comprises an associated Internet website, and said subscriber logs into said website in order to cause said communication to be sent to said managed network.

28. The method of claim 27, wherein said communication is carried over at least a portion of said managed network, and said protected content is delivered using at least a portion of said managed network.

29. The method of claim 28, wherein said request from a subscriber is issued using consumer premises equipment (CPE) registered within said managed network and in operative communication therewith.

30. The method of claim 26, wherein said protected content is delivered without using said managed network.

31. The method of claim 30, wherein said request from a subscriber is issued using a mobile or portable device associated with said subscriber yet not in communication with said managed network.

32. The method of claim 31, wherein said mobile or portable device associated with said subscriber is registered with or known to said managed network.

33. The method of claim 30, wherein said request from a subscriber is issued using a mobile or portable device associated with said subscriber in communication with a third party network, said third party network not being in direct communication with said managed network.

34. A computer readable apparatus having a storage medium, the medium comprising at least one computer program adapted for use in managing remote requests for protected content of a managed content distribution network, the at least one program comprising:

first logic configured to process a received content request from a third party entity, said request being generated at least in part using network subscriber login information;

second logic configured to utilize at least portions of the login information to access a subscriber database maintained by said network;

third logic configured to determine, based on said access and said at least portions of the login information, whether the subscriber is entitled to access said protected content; and

fourth logic configured to cause issuance of a message to said third party entity authorizing or denying provision of said requested content to said subscriber by said third party entity.

35. The apparatus of claim 34, wherein said received content request and said message each comprise messages formatted according to a standardized protocol.

36. The apparatus of claim 35, further comprising logic configured to authenticate said third party entity using at least a Security Assertion Markup Language (SAML) exchange.

37. The apparatus of claim 36, further comprising logic configured to authenticate said third party entity using at least an eXtensible Access Control Markup Language (XACML)-based digitally signed certificate and a Common Secure Interoperability (CSI) session.